Interesting they create a public repo in your GitHub to store the payload. I would have thought would be better and less obvious to just upload the payload to a server they control.